US7349538B2  Hierarchical identitybased encryption and signature schemes  Google Patents
Hierarchical identitybased encryption and signature schemes Download PDFInfo
 Publication number
 US7349538B2 US7349538B2 US10384328 US38432803A US7349538B2 US 7349538 B2 US7349538 B2 US 7349538B2 US 10384328 US10384328 US 10384328 US 38432803 A US38432803 A US 38432803A US 7349538 B2 US7349538 B2 US 7349538B2
 Authority
 US
 Grant status
 Grant
 Patent type
 Prior art keywords
 key
 level
 lower
 generation
 pkg
 Prior art date
 Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
 Active, expires
Links
Images
Classifications

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
 H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
 H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
 H04L9/083—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
 H04L9/0833—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key
 H04L9/0836—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] involving conference or group key using tree structure or hierarchical structure

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/006—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication involving public key infrastructure [PKI] trust models
 H04L9/007—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication involving public key infrastructure [PKI] trust models involving hierarchical structures

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
 H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
 H04L9/0838—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these
 H04L9/0847—Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these involving identity based encryption [IBE] schemes

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
 H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyperelliptic curves
 H04L9/3073—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyperelliptic curves involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, nonrepudiation, key authentication or verification of credentials
 H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, nonrepudiation, key authentication or verification of credentials involving digital signatures

 H—ELECTRICITY
 H04—ELECTRIC COMMUNICATION TECHNIQUE
 H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
 H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication
 H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, nonrepudiation, key authentication or verification of credentials
 H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, nonrepudiation, key authentication or verification of credentials involving digital signatures
 H04L9/3252—Cryptographic mechanisms or cryptographic arrangements for secret or secure communication including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, nonrepudiation, key authentication or verification of credentials involving digital signatures using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes
Abstract
Description
Applicants hereby claim priority under 35 U.S.C. § 119(e) to provisional U.S. patent applications Ser. No. 60/366,292, filed on Mar. 21, 2002, and Ser. No. 60/366,196, filed on Mar. 21, 2002, both of which are incorporated herein by reference.
The present invention relates in general to cryptography and secure communication via computer networks or via other types of systems and devices, and more particularly to hierarchical, identitybased schemes for encrypting and decrypting communications.
Roughly speaking, identitybased cryptosystems are public key cryptosystems in which the public key of an entity is derived from information associated with the entity's identity. For instance, the identity information may be personal information (i.e., name, address, email address, etc.), or computer information (i.e., IP address, etc.). However, identity information may include not only information that is strictly related to an entity's identity, but also widely available information such as the time or date. That is, the importance of the concept of identity information is not its strict relation to the entity's identity, but that the information is readily available to anyone who wishes to encrypt a message to the entity.
An entity's private key is generated and distributed by a trusted party or logical process, typically known as a private key generator (“PKG”). The PKG uses a master secret to generate private keys. Because an entity's public key may be derived from its identity, when Alice wants to send a message to Bob, she does not need to retrieve Bob's public key from a database. Instead, Alice merely derives the key directly from Bob's identifying information. Databases of public keys are unnecessary. Certificate authorities (“CAs”) also are unnecessary. There is no need to “bind” Bob's identity to his public key because his identity is his public key.
The concept of identitybased cryptosystems is not new. It was proposed in A. Shamir, IdentityBased Cryptosystems and Signatures Schemes, ADVANCES IN CRYPTOGRAPHY—CRYPTO '84, Lecture Notes in Computer Science 196 (1984), Springer, 4753. However, practical identitybased encryption schemes have not been found until recently. For instance, identitybased schemes were proposed in C. Cocks, An IdentityBased Encryption Scheme Based on Quadratic Residues, available at http://www.cesg.gov.uk/technology/idpkc/media/ciren.pdf; D. Boneh, M. Franklin, Identity Based Encryption from the Wail Pairing, ADVANCES IN CRYPTOLOGY—CRYPTO 2001, Lecture Notes in Computer Science 2139 (2001), Springer, 213229; and D. Boneh, M. Franklin, Identity Based Encryption from the Wail Pairing (extended version), available at http://www.cs.stanford.edu/˜dabo/papers/ibe.pdf. Cocks's scheme is based on the “Quadratic Residuosity Problem,” and although encryption and decryption are reasonably fast (about the speed of RSA), there is significant message expansion (i.e., the bitlength of the ciphertext is many times the bitlength of the plaintext). The BonehFranklin scheme bases its security on the “Bilinear DiffieHellman Problem,” and it is quite fast and efficient when using Wail or Tate pairings on supersingular elliptic curves or abelian varieties.
However, the known identitybased encryption schemes have a significant shortcoming—they are not hierarchical. In nonidentitybased public key cryptography, it has been possible to have a hierarchy of CAs in which the root CA can issue certificates for other CAs, who in turn can issue certificates for users in particular domains. This is desirable because it reduces the workload on the root CA. A practical hierarchical scheme for identitybased cryptography has not been developed.
Ideally, a hierarchical identitybased encryption scheme would involve a hierarchy of logical or actual PKGs. For instance, a root PKG may issue private keys to other PKGs, who in turn would issue private keys to users in particular domains. It also would be possible to send an encrypted communication without an online lookup of the recipient's public key or lowerlevel public parameters, even if the sender is not in the system at all, as long as the sender obtained the public parameters of the root PKG. Another advantage of a hierarchical identitybased encryption scheme would be damage control. For instance, disclosure of a domain PKG's secret would not compromise the secrets of higherlevel PKGs, or of any other PKGs that are not direct descendents of the compromised domain PKG. The schemes taught by Cocks and BonehFranklin do not have these properties.
A secure and practical hierarchical identitybased encryption scheme has not been developed. A hierarchical identitybased key sharing scheme with partial collusionresistance is given in G. Hanaoka, T. Nishioka, Y. Zheng, H. Imai, An Efficient Hierarchical IdentityBased KeySharing Method Resistant Against Collusion Attacks, ADVANCES IN CRYPTOGRAPHY—ASIACRYPT 1999, Lecture Notes in Computer Science 1716 (1999), Springer 348362; and G. Hanaoka, T. Nishioka, Y. Zheng, H. Imai, A Hierarchical NonInteractive KeySharing Scheme With Low Memory Size and High Resistance Against Collusion Attacks, to appear in THE COMPUTER JOURNAL. In addition, an introduction to hierarchical identitybased encryption was provided in J. Horwitz, B. Lynn, Toward Hierarchical IdentityBased Encryption, to appear in ADVANCES IN CRYPTOGRAPHY—EUROCRYPT 2002, Lecture Notes in Computer Science. Springer. Horwitz and Lynn proposed a twolevel hierarchical scheme with total collusionresistance at the first level and partial collusionresistance at the second level (i.e., users can collude to obtain the secret of their domain PKG and thereafter masquerade as that domain PKG). However, the complexity of the HorwitzLynn system increases with the collusionresistance at the second level, and therefore that scheme cannot be both practical and secure.
Accordingly, there has been a need for a secure and practical hierarchical identitybased encryption scheme. It is therefore an object of the present invention to provide a secure and practical hierarchical identitybased encryption scheme. It is another object of the present invention to provide a secure and practical hierarchical identitybased signature scheme. It is a further object of the present invention that the encryption and signature schemes be fully scalable. It is a still further object of the present invention that the encryption and signature schemes have total collusion resistance on an arbitrary number of levels, and that they have chosenciphertext security in the random oracle model.
In accordance with the present invention, methods are provided for implementing secure and practical hierarchical identitybased encryption and signature schemes.
According to one aspect of the present invention, a method is provided for encoding and decoding a digital message between a sender and a recipient in a system including a plurality of private key generators (“PKGs”). The PKGs include at least a root PKG and n lowerlevel PKG in the hierarchy between the root PKG and the recipient, wherein n≧1. A root key generation secret is selected and is known only to the root PKG. A root key generation parameter is generated based on the root key generation secret. A lowerlevel key generation secret is selected for each of the n lowerlevel PKGs, wherein each lowerlevel key generation secret is known only to its associated lowerlevel PKG. A lowerlevel key generation parameter also is generated for each of the n lowerlevel PKGs using at least the lowerlevel key generation secret for its associated lowerlevel private key generator. The message is encoded to form a ciphertext using at least the root key generation parameter and recipient identity information. A recipient private key is generated such that the recipient private key is related to at least the root key generation secret, one or more of the n lowerlevel key generation secrets associated with the n lowerlevel PKGs in the hierarchy between the root PKG and the recipient, and the recipient identity information. The ciphertext is decoded to recover the message using at least the recipient private key.
According to another aspect of the present invention, a method is provided for encoding and decoding a digital message between a sender and a recipient in a system including a plurality of private key generators (“PKGs”). The PKGs include at least a root PKG, m lowerlevel PKGs in the hierarchy between the root PKG and the sender, wherein m≧1, n lowerlevel PKG in the hierarchy between the root PKG and the recipient, wherein n≧1, and PKG_{l}, which is a common ancestor PKG to both the sender and the recipient. In the hierarchy, l of the m private key generators are common ancestors to both the sender and the recipient, wherein l≧1.
According to this aspect of the invention, a lowerlevel key generation secret is selected for each of the m lowerlevel PKGs in the hierarchy between the root PKG and the sender. A sender private key is generated such that the sender private key is related to at least the root key generation secret, one or more of the m lowerlevel key generation secrets associated with the m lowerlevel PKGs in the hierarchy between the root PKG and the sender, and sender identity information. A recipient private key is generated such that the recipient private key is related to at least the root key generation secret, one or more of the n lowerlevel key generation secrets associated with the n lowerlevel PKGs in the hierarchy between the root PKG and the recipient, and recipient identity information. The message is encoded using at least the recipient identity information, the sender private key, and zero or more of the lowerlevel key generation parameters associated with the (m−l+1) private key generators at or below the level of the common ancestor PKG_{l}, but not using any of the lowerlevel key generation parameters that are associated with the (l−1) PKGs above the common ancestor PKG_{l}. The message is decoded using at least the sender identity information, the recipient private key, and zero or more of the lowerlevel key generation parameters associated with the (n−l+1) private key generators at or below the level of the common ancestor PKG_{l}, but not using any of the lowerlevel key generation parameters that are associated with the (l−1) PKGs above the common ancestor PKG_{l}.
According to another aspect of the present invention, a method is provided for generating and verifying a digital signature of a message between a sender and a recipient in a system including a plurality of PKGs. The PKGs include at least a root PKG and n lowerlevel PKG in the hierarchy between the root PKG and the sender, wherein n≧1. A root key generation secret is selected and is known only to the root PKG. A root key generation parameter is generated based on the root key generation secret. A lowerlevel key generation secret is selected for each of the n lowerlevel PKGs, wherein each lowerlevel key generation secret is known only to its associated lowerlevel PKG. A lowerlevel key generation parameter also is generated for each of the n lowerlevel PKGs using at least the lowerlevel key generation secret for its associated lowerlevel private key generator. A private key is generated for the sender such that the private key is related to at least the root key generation secret and sender identity information. The message is signed to generate the digital signature using at least the sender private key. The digital message is verified using at least the root key generation parameter and the sender identity information.
The subsequent description of the preferred embodiments of the present invention refers to the attached drawings, wherein:
The presently preferred methods of the invention provide secure and practical hierarchical identitybased encryption (“HIDE”) and signature (“HIDS”) schemes. The hierarchical schemes are fully scalable, have total collusion resistance on an arbitrary number of levels, and have chosenciphertext security in the random oracle model. These objectives are achieved, in part, by introducing additional random information at each of the lowerlevel PKGs. One intuitively surprising aspect of these schemes is that, even though lower level PKGs generate additional random information, this does not necessitate adding public parameters below the root level of the hierarchy. In addition, the random information generated by a lowerlevel PKG does not adversely affect the ability of users not under the lowerlevel PKG to send encrypted communications to users under the lowerlevel PKG.
Each of the HIDE and HIDS schemes of the present invention requires a hierarchical structure of PKGs, including at least one root PKG and a plurality of lowerlevel PKGs. The hierarchy and the lowerlevel PKGs may be logical or actual. For instance, a single entity may generate both a root key generation secret and the lowerlevel key generation secrets from which lowerlevel users' encryption or signature keys are generated. In this case, the lowerlevel PKGs are not separate entities, but are merely processes or information arranged in a logical hierarchy and used to generate keys for descendent PKGs and users in the hierarchy. Alternatively, each lowerlevel PKG may be a separate entity. Another alternative involves a hybrid of actual and logical lowerlevel PKGs. For purposes of this disclosure, the term “lowerlevel PKG” will be used generically to refer to any of these alternatives.
In the context of the hierarchical identitybased cryptosystems disclosed herein, identitybased public keys may be based on time periods. For instance, a particular recipient's identity may change with each succeeding time period. Alternatively, a recipient may arrange the time periods as children or descendents of itself in a hierarchy, and a sender would use the identity of the proper time period when encoding the message. Either way, each key may be valid for encrypting messages to Bob only during the associated time period.
The HIDE schemes of the present invention generally include five randomized algorithms: Root Setup, Lowerlevel Setup, Extraction, Encryption, and Decryption. Three of these algorithms rely upon the identities of the relevant entities in the hierarchy. Each user preferably has a position in the hierarchy that may be defined by its tuple of IDs: (ID_{1}, . . . , ID_{t}). The user's ancestors in the hierarchy are the root PKG and the users, or PKGs, whose IDtuples are {(ID_{1}, . . . , ID_{i}): 1≦i≦(t−1)}. The IDtuples preferably are represented as binary strings for purposes of computations.
In the Root Setup algorithm, the root PKG uses a security parameter K to generate public system parameters params and a root key generation secret. The system parameters include a description of the message space M and the ciphertext space C. The system parameters will be publicly available, while only the root PKG will know the root key generation secret.
In the Lowerlevel Setup algorithm, each lowerlevel PKG preferably generates its own lowerlevel key generation secret for purposes of extraction. Alternatively, a lowerlevel PKG may generate random onetime secrets for each extraction.
In the Extraction algorithm, a PKG (whether the root PKG or a lowerlevel PKG) generates a private key for any of its children. The private key is generated using the system parameters, the generating PKG's private key, and any other preferred secret information.
In the Encryption algorithm, a sender receives the system parameters from the root PKG, preferably via some secure means outside the present system. It is not necessary for the sender to receive any of the lowerlevel key generation parameters. The sender encodes a message M∈M to generate a ciphertext C∈C using params and the IDtuple of the intended recipient. Conversely, in the Decryption algorithm, the recipient decodes the ciphertext C to recover the message M using params and the recipient's private key d. Encryption and decryption preferably satisfy the standard consistency constraint:

 ∀M∈M: Decryption(params, d, C)=M
 where C=Encryption(params, IDtuple, M).
Like the HIDE schemes, the HIDS schemes of the present invention also generally include five randomized algorithms: Root Setup, Lowerlevel Setup, Extraction, Signing, and Verification. For Root Setup, the system parameters are supplemented to include a description of the signature space S. Lowerlevel Setup and Extraction preferably are the same as for HIDE, as described above.
In the Signing algorithm, the sender of a digital message signs the message M∈M to generate a signature S∈S using params and the sender's private key d. In the Verification algorithm, the recipient of the signed message verifies the signature S using params and the IDtuple of the sender. The Verification algorithm preferably outputs “valid” or “invalid”. Signing and Verification also preferably satisfies a consistency constraint:

 ∀M∈M: Verification (params, IDtuple, S)=“valid”
 where S=Signing(params, d, M).
Security of HIDE and HIDS Schemes
The security of the schemes embodying the present invention will now be discussed with respect to both HIDE and HIDS. It has been noted in the context of nonhierarchical identitybased cryptography that the standard definition of chosenciphertext security must be strengthened for identitybased systems. This is because it should be assumed, for purposes of a security analysis, that an adversary can obtain the private key associated with any identity of its choice (other than the particular identity being attacked). The same applies to hierarchical identitybased cryptography. Accordingly, to establish that the HIDE schemes of the present invention are chosenciphertext secure, a simulated attacker is allowed to make private key extraction queries. Also, the simulated adversary is allowed to choose the identity on which it wishes to be challenged.
It should also be noted that an adversary may choose the identity of its target adaptively or nonadaptively. An adversary that chooses its target adaptively will first make hash queries and extraction queries, and then choose its target based on the results of these queries. Such an adversary might not have a particular target in mind when it begins the attack. Rather, the adversary is successful it is able to hack somebody. A nonadaptive adversary, on the other hand, chooses its target independently from results of hash queries and extraction queries. For example, such an adversary might target a personal enemy. The adversary may still make hash queries and extraction queries, but its target choice is based strictly on the target's identity, not on the query results. Obviously, security against an adaptivelychosentarget adversary is the stronger, and therefore preferable, notion of security. However, the security analysis of the HIDE schemes in the present invention address both types of security.
A HIDE scheme is said to be semantically secure against adaptive chosen ciphertext and adaptive chosen target attack if no polynomially bounded adversary A has a nonnegligible advantage against the challenger in the following game.
SETUP: The challenger takes a security parameter k and runs the Root Setup algorithm. It gives the adversary the resulting system parameters params. It keeps the root key generation secret to itself.
PHASE 1: The adversary issues queries q_{1}, . . . , q_{m}, where q_{i }is one of:

 1. Publickey query (IDtuple_{i}): The challenger runs a hash algorithm on IDtuple_{i }to obtain the public key H (IDtuple_{i}) corresponding to IDtuple_{i}.
 2. Extraction query (IDtuple_{i}): The challenger runs the Extraction algorithm to generate the private key d_{i }corresponding to IDtuple_{i}, and sends d_{i }to the adversary.
 3. Decryption query (IDtuple_{i}, C_{i}): The challenger runs the Extraction algorithm to generate the private key d_{i }corresponding to IDtuple_{i}, runs the Decryption algorithm to decrypt C_{i }using d_{i}, and sends the resulting plaintext to the adversary.
These queries may be asked adaptively. In addition, the queried IDtuple_{i }may correspond to a position at any level of the hierarchy.
CHALLENGE: Once the adversary decides that Phase 1 is over, it outputs two equallength plaintexts M_{0}, M_{1}∈M and an IDtuple on which it wishes to be challenged. The only constraints are that neither this IDtuple nor its ancestors appear in any private key extraction query in Phase 1. The challenger picks a random bit b C∈{0,1} and sets C=Encryption(params, IDtuple, M_{b}). It sends C as a challenge to the adversary.
PHASE 2: The adversary issues more queries q_{m+1}, . . . , q_{n }where q_{i }is one of:

 1. Publickey query (IDtuple_{i}): The challenger responds as in Phase 1.
 2. Extraction query (IDtuple_{i}): The challenger responds as in Phase 1.
 3. Decryption query (C, IDtuple_{i}): The challenger responds as in Phase 1.
The queries in Phase 2 are subject to the constraint that the challenger cannot make an Extraction query on the IDtuple associated with the challenge ciphertext C, or make a Decryption query using that IDtuple and the ciphertext C. This same constraint also applies to all ancestors of the IDtuple.
GUESS: The adversary outputs a guess b′∈{0,1}. The adversary wins the game if b=b′. The adversary's advantage in attacking the scheme is defined to be Pr[b=b′]−½.
A HIDE schemes is said to be a oneway encryption scheme if no polynomial time adversary has a nonnegligible advantage in the game described below. In this game, the adversary A is given a random public key K_{pub }and a ciphertext C that is the encryption of a random message M using K_{pub}, and outputs a guess for the plaintext. The adversary is said to have an advantage ε against the scheme if ε is the probability that A outputs M. The game is played as follows:
SETUP: The challenger takes a security parameter k and runs the Root Setup algorithm. It gives the adversary the resulting system parameters params. It keeps the root key generation secret to itself.
PHASE 1: The adversary makes public key and/or extraction queries as in Phase 1 of the chosenciphertext security analysis described above.
CHALLENGE: Once the adversary decides that Phase 1 is over, it outputs a new IDtuple ID on which it wishes to be challenged. The challenger picks a random M∈M and sets C=Encryption(params, IDtuple, M). It sends C as a challenge to the adversary.
PHASE 2: The adversary issues more publickey queries and more extraction queries on identities other than ID and its ancestors, and the challenger responds as in Phase 1.
GUESS: The adversary outputs a guess M′∈M. The adversary wins the game if M=M′. The adversary's advantage in attacking the scheme is defined to be Pr[M=M′].
The schemes of the present invention are secure against the challenges described above. In addition, the HIDS schemes of the present invention are secure against existential forgery on adaptively chosen messages. An adversary should be unable to forge its target's signature on other messages that the target has not signed previously, even after (adaptively) obtaining the target's signature on messages of the adversary's choosing. A HIDS adversary also will have the ability to make public key queries and private key extraction queries on entities other than the target and its ancestors, and the ability to choose its target. As with HIDE, the adversary's choice of target may be adaptive or nonadaptive.
Pairings
The presently preferred HIDE and HIDS schemes of the present invention are based on pairings, such as, for instance, the Wail or Tate pairings associated with elliptic curves or abelian varieties. The methods also are based on the Bilinear DiffieHellman problem. They use two cyclic groups G_{1 }and G_{2}, preferably of the same large prime order q. The first group G_{1 }preferably is a group of points on an elliptic curve or abelian variety, and the group law on G_{1 }may be written additively. The second group G_{2 }preferably is a multiplicative subgroup of a finite field, and the group law on G_{2 }may be written multiplicatively. However, other types of groups may be used as G_{1 }and G_{2 }consistent with the present invention.
The methods also use a generator P_{0 }of the first group G_{1}. In addition, a pairing or function ê: G_{1}×G_{1}→G_{2 }is provided for mapping two elements of the first group G_{1 }to one element of the second group G_{2}. The function ê preferably satisfies three conditions. First, the function ê preferably is bilinear, such that if Q and R are in G_{1 }and a and b are integers, then ê(aQ, bR)=ê(Q, R)^{ab}. Second, the function ê preferably is nondegenerate, such that the map does not send all pairs in G_{1}×G_{1 }to the identity in G_{2}. Third, the function ê preferably is efficiently computable. A function ê satisfying these three conditions is considered to be admissible.
The function ê also preferably is symmetric, such that ê(Q, R)=ê(R, Q) for all Q, R∈G_{1}. Symmetry, however, follows immediately from the bilinearity and the fact that G_{1 }is a cyclic group. Wail and Tate pairings associated with supersingular elliptic curves or abelian varieties can be modified to create such bilinear maps according to methods known in the art. However, even though reference to elements of the first cyclic group G_{1 }as “points” may suggest that the function ê will work. it should be noted that any admissible pairing ê will work.
The security of the HIDE and HIDS schemes of the present invention is based primarily on the difficulty of the Bilinear DiffieHellman problem. The Bilinear DiffieHellman problem is that of finding ê(P, P)^{abc }given a randomly chosen P∈G_{1}, as well as aP, bP, and cP (for unknown randomly chosen a, b, c∈Z/qZ). Solving the DiffieHellman problem in G_{1 }solves the Bilinear DiffieHellman problem because ê(P, P)^{abc}=ê(abP, cP). Similarly, solving the DiffieHellman problem in G_{2 }solves the Bilinear DiffieHellman problem because, if g=ê(P, P), then g^{abc}=(g^{ab})^{c }where g^{ab}=ê(aP, bP) and g^{c}=ê(P, cP). For the Bilinear DiffieHellman problem to be hard, G_{1 }and G_{2 }should be chosen such that there is no known algorithm for efficiently solving the DiffieHellman problem in either G_{1 }or G_{2}. If the Bilinear DiffieHellman problem is hard for a pairing ê, then it follows that ê is nondegenerate.
A randomized algorithm IG is a Bilinear DiffieHellman generator if IG takes a security parameter k>0, runs in time polynomial in k, and outputs the description of two groups G_{1 }and G^{2}, preferably of the same prime order q, and the description of an admissible pairing ê: G_{1}×G_{1}→G_{2}. If IG is a Bilinear DiffieHellman parameter generator, the advantage Adv_{IG}(B) that an algorithm B has in solving the Bilinear DiffieHellman problem is defined to be the probability that the algorithm B outputs ê(P, P)^{abc }when the inputs to the algorithm are G_{1}, G_{2}, ê, P, aP, bP, and cP, where (G_{1}, G_{2}, ê) is the output of IG for a sufficiently large security parameter K, P is a random generator of G_{1}, and a, b, and c are random elements of Z/qZ. The assumption underlying the Bilinear DiffieHellman problem is that Adv_{IG}(B) is negligible for all efficient algorithms B.
HIDE Schemes
Referring now to the accompanying drawings,
In block 102, the root PKG selects a root key generation secret known only to the root PKG. The root key generation secret may be used to generate private keys for PKGs and/or users below the root PKG in the hierarchy. The root PKG then generates a root key generation parameter based on the root key generation secret in block 104. The root key generation parameter is used to mask the root key generation secret. The root key generation parameter may be revealed to lowerlevel PKGs without compromising the root key generation secret. The lowerlevel PKGs select lowerlevel key generation secrets in block 106. The lowerlevel key generation secret associated with a given lowerlevel PKG may be used to generate private keys for PKGs and/or users below the associated lowerlevel PKG in the hierarchy. Like the root key generation secret, each of the lowerlevel key generation secrets is known only to its associated lowerlevel PKG.
In block 108, lowerlevel key generation parameters are generated for each of the n lowerlevel PKGs. Each of the lowerlevel key generation parameters is generated using at least the lowerlevel key generation secret for its associated lowerlevel PKG. Like the root key generation parameter, each of the lowerlevel key generation parameters masks its associated lowerlevel key generation secret.
Using at least the root key generation parameter and identity information associated with the recipient, the sender encodes the message in block 110 to form a ciphertext. For instance, the message may be encoded using only the root key generation parameter and the recipient's identity. Alternatively, one of the lowerlevel key generation parameters may be used, such as is described in more detail below with respect to dualHIDE schemes. In block 112, a lowerlevel PKG generates a private key for the recipient such that the private key is related to at least the root key generation secret, one or more of the n lowerlevel key generation secrets associated with the n lowerlevel PKGs in the hierarchy between the root PKG and the recipient, and the recipient's identity information. For instance, in addition to root key generation secret and the recipient's identity information, the recipient's private key preferably also is related at least to the lowerlevel key generation secret of the PKG that issued the private key to the recipient. Alternatively, the recipient's private key may be related to all n of its ancestral PKG's lowerlevel key generation secrets, as well as the root key generation secret. In block 114, the recipient uses at least its private key to decode the ciphertext and recover the message. In addition to using its private key to decode, the recipient preferably also uses the n lowerlevel key generation parameters associated with the n lowerlevel PKGs in the hierarchy between the root PKG and the recipient.
Each lowerlevel PKG has a key generation secret, just like the root PKG. As described above, a lowerlevel PKG preferably uses this secret to generate a private key for each of its children, just as the root PKG does. As a result, the children's private keys are related to the lowerlevel PKG's key generation secret. This is true even if the lowerlevel PKG uses a modified version of its key generation secret to obscure that secret for purposes of restricting key escrow, as described more fully below. At the same time, the lowerlevel PKGs need not always use the same secret for each private key extraction. Rather, a new key generation secret could be generated randomly for each of the PKG's children, resulting in a different key generation parameter for each child.
Because a lowerlevel PKG is able to generate a private key for the recipient (block 112), the root PKG need not generate all of the private keys itself. In addition, because the lowerlevel PKGs use their own key generation secrets to generate private keys for their descendants, compromising a lowerlevel key generation secret causes only limited security damage to the hierarchy. Rather than compromising all of the private keys in the hierarchy, a breach of a lowerlevel PKG compromises only the private key of that PKG and those private keys that were generated using that PKG's key generation secret (i.e., the private keys of those users that are direct hierarchical descendants of the compromised PKG).
Another advantage of this embodiment is that the sender need not be in the hierarchy to send an encoded message to the recipient. The sender merely needs to know the identity information associated with the recipient and the system parameters generated by the root PKG. There are however, certain additional advantages of the HIDE schemes of the present invention that become available when the sender is positioned within the hierarchy. For instance, when both the sender and the recipient are in the hierarchy, the efficiency of the message encryption may be improved by using the identities of both parties. This type of HIDE scheme may be referred to as dualHIDE because the identities of both the sender and the recipient are used as input for the encryption and decryption algorithms. A method of encoding and decoding a message using a dualHIDE scheme will now be discussed with reference to
DualHIDE
The method of this embodiment begins in block 202, when the root PKG 302 selects a root key generation secret known only to the root PKG 302. The root PKG 302 then generates a root key generation parameter based on the root key generation secret in block 204. The lowerlevel PKGs 304 ad select lowerlevel key generation secrets in block 206. Like the root key generation secret, each of the lowerlevel key generation secrets is known only to its associated lowerlevel PKG 304 ad. In block 208, lowerlevel key generation parameters are generated for each of the n lowerlevel PKGs 304 ad. Each of the lowerlevel key generation parameters is generated using at least the lowerlevel key generation secret for its associated lowerlevel PKG 304 ad.
In block 210, the sender's parent PKG_{ym } 304 c generates a private key for the sender y 306 such that the private key is related to at least the root key generation secret, one or more of the m lowerlevel key generation secrets associated with the m lowerlevel PKGs 304 a,b,c between the root PKG 302 and the sender y 306, and the sender's identity information. For instance, in addition to root key generation secret and the sender's identity information, the sender's private key preferably is related at least to the lowerlevel key generation secret of the sender's parent PKG_{ym } 304 c. Alternatively, the sender's private key may be related to all m of its direct ancestral PKGs' lowerlevel key generation secrets, as well as the root key generation secret. In block 212, the recipient's parent PKG_{zn } 304 d generates a private key for the recipient z in a similar manner that the sender's parent PKG_{ym } 304 c used to generate the sender's private key.
In block 214, the sender y encodes the message to form a ciphertext using at least the sender's private key and one or more of the lowerlevel key generation parameters associated with the (m−l+1) PKGs (i.e., PKG_{yl}, 304 b and PKG_{ym } 304 c) between the root PKG 302 and the sender y 306 that are at or below the level of the lowest ancestor PKG (PKG_{yl}/PKG_{zl } 304 b) that is common to both the sender y 306 and the recipient z 308. In encoding the message, the sender y 306 preferably does not use any of the lowerlevel key generation parameters that are associated with the (l−1) PKGs (i.e., PKG_{y1 } 304 a) that are above the lowest common ancestor PKG (PKG_{yl}/PKG_{zl } 304 b).
The recipient z 308 then decodes the ciphertext to recover the message in block 216 using at least the recipient's private key and one or more of the lowerlevel key generation parameters associated with the (n−l+1) PKGs (i.e., PKG_{zl}, 304 b and PKG_{zn } 304 c) between the root PKG 302 and the recipient z 308 that are at or below the level of the lowest ancestor PKG (PKG_{yl}/PKG_{zl } 304 b) that is common to both the sender y 306 and the recipient z 308. In decoding the message, the recipient z 306 preferably does not use any of the lowerlevel key generation parameters that are associated with the (l−1) PKGs (i.e., PKG_{z1 } 304 a) that are above the lowest common ancestor PKG (PKG_{yl}/PKG_{zl } 304 b).
This dualHIDE embodiment of the invention provides a more efficient scheme for encoding and decoding the message because it requires the use of fewer key generation parameters. For instance, decoding in a regular HIDE scheme preferably requires all n of the key generation parameters, but decoding in a dualHIDE scheme preferably requires only (n−l+1) of the key generation parameters. DualHIDE schemes require the sender y 306 to obtain its private key before sending an encoded message to the recipient z 308, as opposed to merely obtaining the public system parameters of the root PKG. The dualHIDE schemes also enable the sender y 306 and the recipient z 308 to restrict the scope of key escrow, as described more fully below. This shared secret is unknown to third parties other than their lowest common ancestor PKG_{yl}/PKG_{zl } 304 b.
BasicHIDE
In some embodiments, the scheme is as follows. Let Level_{i }be the set of entities at level i, where Level_{0}={Root PKG}. Let K be the security parameter given to the setup algorithm and let IG be a BDH parameter generator.
Root Setup: The root PKG:

 1. runs IG on input K to generate groups G_{1}, G_{2 }of some prime order q and an admissible pairing ê: G_{1}×G_{1}→G_{2};
 2. chooses an arbitrary generator P_{0}∈G_{1};
 3. picks a random S_{0}∈Z/qZ and sets Q_{0}=s_{0}P_{0};
 4. chooses cryptographic hash functions H_{1}:{0,1}*→G_{1 }and H_{2}:G_{2}→{0,1}^{n }for some n. The security analysis will treat H_{1 }and H_{2 }as random oracles.
The message space is M={0,1}^{n}. The ciphertext space C=G_{1} ^{t}×{0,1}^{t }where t is the level of the recipient. The system parameters are params={G_{1},G_{2},ê,P_{0},Q_{0},H_{1},H_{2}}. The root PKG's secret is s_{0}∈Z/qZ.
Lowerlevel Setup. Entity E_{t}∈Level_{t }picks a random s_{t}∈Z/qZ, which it keeps secret.
Extraction: Let E_{t }be an entity in Level_{t }with IDtuple (ID_{1}, . . . , ID_{t}), where (ID_{1}, . . . , ID_{i}) for 1≦i≦t is the ID tuple of E_{t}'s ancestor at Level_{i}. Set S_{0 }to be the identity element of G_{1}. The E_{t}'s parent:

 1. computes P_{t}=H_{1}(ID_{1}, . . . , ID_{t})∈G_{1};
 2. sets E_{t}'s secret point S_{t }to be S_{t−1}+s_{t−1}P_{t}=Σ_{i=1} ^{t }s_{t−1 }P_{i};
 3. also gives E_{t }the values of Q_{i}=s_{i}P_{0 }for 1≦i≦t−1.
Encryption: To encrypt M∈M with the IDtuple (ID_{1}, . . . , ID_{t}), do the following:

 1. Compute P_{i}=H_{1}(ID_{1}, . . . , ID_{i})∈G_{1 for }1≦i≦t.
 2. Choose a random r∈Z/qZ.
 3. Set the ciphertext to be
 C=[rP_{0},rP_{2}, . . . , rP_{t}, M⊕H_{2}(g^{r})]where g=ê(Q_{0},P_{1})∈G_{2}.
Decryption: Let C=[U_{0}, U_{2}, . . . , U_{t}, V]∈C be the ciphertext encrypted using the IDtuple (ID_{1}, . . . , ID_{t}). To decrypt C, E_{t }computes:
V⊕H _{2}(ê(U _{0} ,S _{t})/Π_{i=2} ^{t} ê(Q _{i−1} ,U _{i}))=M.
This concludes the description of one embodiment of our BasicHIDE scheme.
Remark 1. Each lowerlevel PKG−say, in Level_{t}−has a secret s_{t}∈Z/qZ, just like the root PKG. A lowerlevel PKG uses this secret to generate a secret point for each of its children, just as the root PKG does. An interesting fact, however, is that lowerlevel PKGs need not always use the same s_{t }for each private key extraction. Rather, s_{t }could be generated randomly for each of the PKG's children.
Remark 2. H_{1 }can be chosen to be an iterated hash function so that, for example, P_{i }may be computed as H_{1}(P_{i−1},ID_{i}) rather than H_{1 }(ID_{1}, . . . , ID_{i}).
The next series of blocks (blocks 416 through 424) show the functions performed as part of Lowerlevel Setup algorithm. In block 416, a public element P_{zi }is generated for each of the recipients' n ancestral lowerlevel PKGs. Each of the public elements, P_{zi}=H_{1}(ID_{1}, . . . , ID_{zi}) for 1≦i≦n, preferably is an element of the first cyclic group G_{1}. Although represented in a single block, generation of all the public elements P_{zi }may take place over time, rather than all at once.
A lowerlevel key generation secret s_{zi }is selected (block 418) for each of the recipients' n ancestral lowerlevel PKGs 304 a,b,d. The lowerlevel key generation secrets s_{zi }preferably are elements of the cyclic group Z/qZ for 1≦i≦n, and each lowerlevel key generation secret s_{zi }preferably is known only to its associated lowerlevel PKG. Again, although represented in a single block, selection of all the lowerlevel key generation secrets s_{zi }may take place over time, rather than all at once.
A lowerlevel secret element S_{zi }is generated (block 420) for each of the sender's n ancestral lowerlevel PKGs. Each lowerlevel secret element, S_{zi}=S_{z(i−1)}+s_{z(i−1)}P_{zi }for 1≦i≦n, preferably is an element of the first cyclic group G_{1}. Although represented in a single block like the public elements P_{zi }and the secrets s_{zi}, generation of all the secret elements S_{zi }may take place over time, rather than all at once. For purposes of these iterative key generation processes, S_{0 }may be defined to be the identity element of G_{1}.
A lowerlevel key generation parameter Q_{zi }also is generated (block 422) for each of the recipients' n ancestral lowerlevel PKGs. Each of the key generation parameters, Q_{zi}=s_{zi}P_{0 }for 1≦i≦n, preferably is an element of the first cyclic group G_{1}. Again, although represented in a single block, generation of all the key generation parameters Q_{zi }may take place over time, rather than all at once.
The functions of the next two blocks (blocks 424 and 426) are performed as part of the Extraction algorithm described above. A recipient public element P_{z(n+1) }associated with the recipient z is generated in block 424. The recipient public element, P_{z(n+1)}=H_{1}(ID_{z1}, . . . , ID_{z(n+1)}), preferably is an element of the first cyclic group G_{1}. A recipient secret element S_{z(n+1) }associated with the recipient z is then generated in block 426. The recipient secret element
also preferably is an element of the first cyclic group G_{1}.
For convenience, the first function H_{1 }optionally may be chosen to be an iterated function so that, for example, the public points P_{i }may be computed as H_{1}(P_{z(i−1)}, ID_{zi}) rather than H_{1 (ID} _{1}, . . . , ID_{zi}).
The last two blocks shown in
The blocks shown in
The specific use of the parameters and elements described above in the encoding and decoding of the message M and the ciphertext C will now be discussed with reference to
FullHIDE
It is known that FujisakiOkamato padding can be used to convert a basic IBE scheme to an IBE scheme that is chosen ciphertext secure in the random oracle model. In the same way, BasicHIDE can be converted to FulLHIDE, a HIDE scheme that is chosen ciphertext secure in the random oracle model. Next we describe the scheme FullHIDE. One embodiment is as follows:
Setup: As in the BasicHIDE scheme, but in addition choose hash functions H_{3}: {0,1}^{n}×{0,1}^{n}→Z/qZ and H4:{0,1}^{n}→{0,1 }^{n}.
Extraction: As in the BasicHIDE scheme.
Encryption: To encrypt M∈M with the IDtuple (ID_{1}, . . . , ID_{t}), do the following:

 1. compute P_{i}=H_{1}(ID_{1}, . . . , ID_{i})∈G_{1 }for 1≦i≦t,
 2. choose a random σ∈{0,1}^{n},
 3. set r=H_{3}(σ,M), and
 4. set the ciphertext to be
C=[rP _{0} , rP _{2} , . . . , rP _{t} ,σ⊕H _{2}(g ^{r}), M⊕H _{4}(σ)]  where g=ê(Q_{0},P_{1})∈G_{2 }as before.
Decryption: Let C=[U_{0}, U_{2}, . . . , U_{t}, V, W]∈C be the ciphertext encrypted using the IDtuple (ID_{1}, . . , ID_{t}). If (U_{0}, U_{2}, . . . , U_{t})∈G_{1} ^{t}, reject the ciphertext. To decrypt C, E_{t }does the following:

 1. computes
V⊕H _{2}(ê(U _{0} ,S _{t})/Π_{i=2} ^{t} ê(Q _{i−1} ,U _{i}))=σ,  2. computes W⊕H_{4}(σ)=M,
 3. sets r=H_{3}(σ,M) and tests that U_{0}=rP_{0 }and U_{i}=rP_{i }for i=2, . . . , t. If not, it rejects the ciphertext.
 4. outputs M as the decryption of C.
 1. computes
Note that M is encrypted as W=M⊕H_{4}(σ). This can be replaced by W=E_{H} _{ 4 } _{(σ)}(M) where E is a semantically secure symmetric encryption scheme.
Using known methods for making oneway encryption schemes secure against chosenciphertext attacks, a BasicHIDE scheme may be converted to a FullHIDE scheme that is chosen ciphertext secure in the random oracle model. A FullHIDE scheme that is chosen ciphertext secure will now be discussed with reference to
The Root Setup algorithm is completed by selecting a third function H_{3 }(block 615 a) and a fourth function H_{4 }(block 615 b). The third function H_{3 }preferably is capable of generating an integer of the cyclic group Z/qZ from two strings of binary digits. The fourth function H_{4 }preferably is capable of generating one binary string from another binary string.
The Encryption algorithm begins with block 628 a, which shows the selection of a random binary string σ. The random binary string σ is then used to generate a random integer r=H_{3}(σ, M, W), as shown in block 628 b, wherein W is a symmetric encryption of the actual message M. The encryption preferably is generated using a symmetric encryption algorithm E, and using H_{4}(σ) as the encryption key. Accordingly, W=E_{H} _{ 4 } _{(σ)}(M). In block 628 c, the ciphertext C=[U_{0}, U_{2}, . . . , U_{n+1}, V, W] is generated. The ciphertext C includes elements U_{i}=rP_{zi }for i=0 and for 2≦i≦n+1, which relate to the location of the recipient in the hierarchy. The second part of the ciphertext C is the random binary string σ in encrypted form, V=σ⊕H_{2}(g^{r}), wherein g=ê(Q_{0}, P_{z1}). The element g preferably is a member of the second cyclic group G_{2}. The third part of the ciphertext C is W, the actual message in symmetrically encrypted form, as described above.
The Decryption algorithm begins with block 630 _{a}, which shows the recovery of the random binary string σ. The random binary string σ is recovered using the formula
The message M is then recovered from the ciphertext C (block 630 b) using the formula M=E_{H} _{ 4 } _{(σ)} ^{−1}(W). The ciphertext optionally may be checked for internal consistency. For instance, an experimental random integer r′=H_{3}(σ, M, W) may be generated, as shown in block 630 c. The experimental random integer r′ then may be used in block 630 d to confirm that U_{0}=r′P_{0 }and U_{i}=r′P_{zi }for 2≦i≦n+1. If so, then the ciphertext C is considered to be authentic.
DualBasicHIDE and DualFullHIDE
In 2000, Sakai, Ohgishi and Kasahara presented a “key sharing scheme” based on the Wail pairing. The idea was quite simple: suppose a PKG has a master secret s, and it issues private keys to users of the form sP_{y }where P_{y}=H_{1}(ID_{y}) and ID_{y }is the ID of user y (as in BonehFranklin). Then users y and z have a shared secret that only they (and the PKG) may compute, namely ê(sP_{y},P_{z})=ê(P_{y,sP} _{z}). They may use this shared secret to encrypt their communications. Notice that this “key sharing scheme” does not require any interaction between the parties. We can view Sakai, Ohgishi and Kasahara's discovery as a type of “dualidentitybased encryption,” where the word “dual” indicates that the identities of both the sender and the recipient (rather than just the recipient) are required as input into the encryption and decryption algorithms. The only significant practical difference between this scheme and the BonehFranklin IBE scheme is that the sender must obtain its private key from the PKG before sending encrypted communications, as opposed to merely obtaining the public parameters of the PKG.
In the nonhierarchical context, DualIBE does not appear to have any substantial advantages over IBE. In the hierarchical context, however, DualHIDE may be more efficient than HIDE if the sender and recipient are close to each other in the hierarchy tree. Suppose two users, y and z, have the IDtuples (ID_{y1}, . . . , ID_{yl}, . . . ,ID_{ym}) and (ID_{z1}, . . . , ID_{zl}, . . . , ID_{zn}), where (ID_{y1}, . . . , ID_{yl})=(ID_{z1}, . . . , ID_{zl}). In other words, user y is in Level_{m}, user z is in Level_{n}, and they share a common ancestor in Level_{t}. User y may use DualHIDE to encrypt a message to user z as follows:
Encryption: To encrypt M∈M, user y:

 1. Computes P_{zi}=H_{1}(ID_{z1}, . . . , ID_{zi})∈G_{1 }for l+1≦i≦n.
 2. Chooses a random r∈Z/qZ.
 3. Set the ciphertext to be:
C=[rP _{0} ,rP _{z(l+1)} , . . . , rP _{zn} , M⊕H _{2}(g _{yl} ^{r})]
where
g _{yl} =ê(P _{0} ,S _{y})/Π_{i=l+1} ^{n} ê(Q _{y(i−1}),U _{i}) =ê(P _{0} ,S _{yl}),
S _{y }is y's secret point, S_{yl }is the secret point of y's and z's common ancestor at level l, and
Q_{yt}=s_{yi}P_{0 }where s_{yi }is the secret number chosen by y's ancestor at level i.
Decryption. Let C=[U_{0},U_{l+1}, . . . , U_{n}, V]be the ciphertext. To decrypt C, user z computes:
V⊕H _{2}(ê(U _{0} ,S _{z})/Π_{i=l+1} ^{m} ê(Q _{z(i−1)} ,U _{i}))=M.
Note that if y and z have a common ancestor below the root PKG, then the ciphertext is shorter with DualHIDE than with nondual HIDE. Further, using DualHIDE, the encrypter y computes m−l+1 pairings while the decryptor z computers n−l+1 pairings. (Note that m+n−2l is the “length” of the path between y and z in the hierarchy tree.) In the nondual HIDE scheme, the encrypter computes one pairing (or receives it as a percomputer value) while the decrypter computers n pairings. Thus when m<2l−1, the total work is less with DualHIDE than with nondual HIDE. The relative computing power of the sender and recipient can also be taken into account.
The number of pairings thaty and z must compute can be decreased to m+n−2l+1 if their common ancestor in Level_{l }always uses the same s_{l }rather than generating this number randomly with each private key extraction. Encryption and decryption proceed as follows:
Encryption: To encrypt M∈M, user y:

 1. Computes P_{zi}=H_{1}(ID_{z1}, . . . , ID_{zi})∈G_{1 }for l+1≦i≦n.
 2. Chooses a random r∈Z/qZ.
 3. Set the ciphertext to be:
C=[rP _{0} ,r(P _{z(l+1)} −P _{z(l+1)}),rP _{z(l−2)} . . . , rP _{zn} ,M⊕H _{2}(g _{y(l−1)} ^{r})]
where
g _{y(l+1)} =ê(P _{0} ,S _{y})/Π_{i=l+2} ^{m} ê(Q _{Y(} _{i−1)} ,P _{yi}) =ê(P _{0} ,S _{y)l+1)}),
where S_{y }is y's secret point and S_{y(l+1) }is the secret point of y's ancestor at level l+1.
Decryption: Let C=[U_{0}, U_{l+1}, . . . , U_{n}, V]be the ciphertext. To decrypt C, user z computes:
V⊕H _{2}(ê(U _{0} ,S _{z})ê(U _{l+1} ,Q _{zl}/Π_{i=l+2} ^{n} ê(Q _{z(i−1)} ,U _{i}))=M.
The concept of dualHIDE described with reference to
Given these additional parameters, a message M may be encoded to generate a ciphertext C according the principles of dualHIDE by using the lowerlevel key generation parameters Q_{yi }for i≧l and the sender secret element S_{y(m+1)}, but not using the lowerlevel key generation parameters Q_{yi }for i<l. Similarly, the ciphertext C may be decoded to recover the message M using the lowerlevel key generation parameters Q_{zi }for i≧l and the recipient secret element S_{z(n+1)}, but not using the lowerlevel key generation parameters Q_{zi }for i<l.
For instance, in a BasicHIDE scheme (
The U_{i }factors are calculated in the same way as before, but fewer of them are necessary. However, dualBasicHIDE does require the sender y to use more key generation parameters Q_{yi }to generate g_{yl }than are necessary to generate g as describe above. This is because the sender's identity is being incorporated into the Encryption algorithm.
The increase in efficiency of the Decryption algorithm is more dramatic. The message M is recovered using
Again, fewer U_{i }parameters are necessary. Similarly, the recipient requires fewer key generation parameters Q_{zi }for dualHIDE than would otherwise be necessary.
FullHIDE also may be modified to create a dualFullHIDE scheme. Generation of the ciphertext C in the Encryption algorithm is modified such that C=[U_{0}, U_{l+1}, . . . , U_{n+1}, V, W], wherein U_{i}=rP_{zi }for i=0 and for l+1≦i≦n+1. The W and r parameters is still generated the same way, W=E_{H} _{ 4 } _{(σ)}(M) and the g_{yl }parameter in V=σ⊕H_{2}(g_{yl} ^{r}) is generated using
The Decryption algorithm also is modified in a dualFullHIDE scheme. The random binary string σ is recovered using
Otherwise, recovery of the message M does not change.
Although these dualHIDE schemes have been described using PKG_{l } 304 b as the lowest ancestor PKG common to both the sender y and the recipient z, PKG_{l } 304 b may be any common ancestor PKG. The encryption and decryption algorithms are the same. For maximum efficiency however, it is preferable that PKG_{l } 304 b be the lowest common ancestor PKG.
In addition to the increase in efficiency, the dualHIDE schemes of the present invention also offer increased security by restricting key escrow. In the BasicHIDE and FullHIDE schemes described above, all of the recipient's direct ancestor PKGs are able to decrypt messages to the recipient. However, because the dualHIDE schemes incorporate the key generation secret of PKG_{l−1 }(the immediate parent of PKG_{l}), which is unknown to the common ancestor PKGs above PKG_{l−1}, those common ancestor PKGs are not able to decrypt messages between the sender y and the recipient z. The immediate parent of PKG_{l } 304 b is still able to decrypt messages, however, because it knows its own key generation secret.
Key escrow may be further restricted such that even the immediate parent of PKG_{l }may not decrypt messages between the sender y and the recipient z. This may be accomplished by obscuring PKG_{l}'s private key in the process of generating private keys for the sender y and the recipient z (or private keys for children of PKG_{l }that are ancestors of the sender y and the recipient z). For instance, PKG_{l } 304 b may easily change its private key by setting S′_{l}:=S_{l}+bP_{l}, and Q′_{l−1}:=Q_{l−1}+bP_{0}, for some random b∈Z/qZ. The new private key S′_{l }is just as effective, but is unknown to PKG_{l}'s immediate parent. Accordingly, no PKGs above PKG_{l }are able to decode messages encrypted to the recipient z. More specifically, only ancestors of the recipient z that are within PKG_{l}'s domain are able to decrypt messages to the recipient z.
When PKG_{l } 304 b changes its private key by setting S′_{l}:=S_{l}+bP_{l}, and Q′_{l−1}:=Q_{l−1}+bP_{0}, the new private key is still related to PKG_{l−1}'s key generation secret s_{l−1}, because the new private key is derived from a private key generated by PKG_{l−1 }using s^{l−1}. In general, in all of the schemes discussed herein, a user or PKG may change its own secret element S_{z(n+1) }and key generation parameters Q_{zi }for 1≦i≦n by choosing values for b_{i }for 1≦i≦n and setting S′_{z(n+1)}:=S_{z(n+1)}+Σ_{i=1} ^{n}b_{i}P_{z(i+1) }and Q′_{zi}:=Q_{zi}+b_{i}P_{0 }for 1≦i≦n. For purposes of the present invention, however, this new private key is still considered to be related to the original private key, and is thus related to the original values of the key generation secrets s_{zi}.
DualHIDE Scheme with More Efficient Encryption or Decryption
In the dualHIDE schemes described above, it is possible to decrease by one the number of values of the pairing that the encrypter must compute without increasing the number of values of the pairing that the decrypter must compute. For instance, the dualBasicHIDE Encryption algorithm described above may be modified such that the ciphertext C=[rP_{0},r(P_{y(l+1)}−P_{z(l+1)}),rP_{z(l+2)}, . . . ,rP_{z(n+1)},M⊕H_{2}(g_{y(l+1)} ^{r})], where
If the ciphertext is represented
then it may be decrypted using
Likewise, it is possible to decrease by one the number of values of the pairing that the decrypter must compute without increasing the number of values that the encrypter must compute. For instance, the dualBasicHIDE Encryption algorithm may be modified such that the ciphertext C=[rP_{0},rP_{y(l+2)}, . . . ,rP_{y(n),M⊕H} _{2 }(g_{z(l+1)} ^{r})], where
If the ciphertext is represented as C=[U_{0}, U_{l+2}, . . . ,U_{n},V], then it may be decrypted using
Authenticated LowerLevel Root PKGs
The efficiencies of the dualHIDE schemes described above may be extended to message senders who are outside the hierarchy by creating an authenticated lowerlevel root PKG. To “authenticate” the lowerlevel PKG, the root PKG may issue an additional parameter, such as a random message M′. The lowerlevel PKG then “signs” M′, generating the signature Sig=S_{zl}+s_{zl}P_{M′}, where S_{l }is the lowerlevel PKG's private key, and s_{t }is its lowerlevel key generation secret. The lowerlevel PKG also publishes Q_{i }for 1≦i≦t.
Taking advantage of the authenticated lowerlevel root PKG, a sender outside the hierarchy may send an encrypted message to the recipient z without computing public elements P_{zi }for all n of the recipient's ancestor PKGs. Rather, the sender may use the parameters for the lowerlevel authenticated root PKG to encrypt the message more efficiently. In particular, the sender computes P_{zi}=H_{1}(ID_{1}, . . . , ID_{zi})∈G_{1 }for l+1≦i≦n+1. The sender then chooses a random r∈Z/qZ, and generates the ciphertext C=[rP_{0},rP_{z(l+1)}, . . . ,rP_{z(n+1)},M⊕H_{2}(g_{zl} ^{r})], where
Letting the received ciphertext C=[U_{0},U_{l+1}, . . . ,U_{n+1},V], the recipient may then decrypt the ciphertext to recover the message
where S_{z(n+1) }is the recipient's private key.
Distributed PKGs
To further protect the key generation secrets of the HIDE schemes described above, and to make the schemes robust against dishonest PKGs, the key generation secrets and private keys may be distributed using known techniques of threshold cryptography.
More Efficient Encryption
The efficiency of encryption for the HIDE schemes described above may be increased by merging the highest two levels of the hierarchy into a single root PKG. In that case, g=ê(Q_{0},P_{1}) is included in the system parameters. This saves encrypters the task of computing the value of this pairing. However, the decrypters must compute one extra pairing (as a result of being one level lower down the tree).
HIDS Schemes
Turning now to the signature, or HIDS, schemes of the present invention,
In block 710, a lowerlevel PKG generates a private key for the recipient such that the private key is related to at least one of the n lowerlevel key generation secrets. For instance, the sender's private key may be related at least to the lowerlevel key generation secret of the PKG that issued the private key to the recipient. Preferably, however, the recipient's private key may be related to all n of its ancestral PKG's lowerlevel key generation secrets, as well as the root key generation secret. In block 712, the sender uses at least its private key to sign the message and generate the digital signature. The recipient, or verifier, then verifies the digital signature in block 714 using at least one of the lowerlevel key generation parameters. For instance, the signature may be verified using only the root key generation parameter. Alternatively, one or more of the lowerlevel key generation parameters also may be used.
The next series of blocks (blocks 816 through 824) show the functions performed as part of Lowerlevel Setup algorithm. In block 816, a public element P_{yi }is generated for each of the sender's m ancestral lowerlevel PKGs. Each of the public elements, P_{yi}=H_{1}(ID_{1}, . . . , ID_{yi}) for 1≦i≦m, preferably is an element of the first cyclic group G_{1}. Although represented in a single block, generation of all the public elements P_{yi }may take place over time, rather than all at once.
A lowerlevel key generation secret S_{yi }is selected (block 818) for each of the sender's m ancestral lowerlevel PKGs 304 a,b,d. The lowerlevel key generation secrets s_{yi }preferably are elements of the cyclic group Z/qZ for 1≦i≦m, and each lowerlevel key generation secret s_{yi }preferably is known only to its associated lowerlevel PKG. Again, although represented in a single block, selection of all the secrets s_{yi }may take place over time, rather than all at once.
A lowerlevel secret element S_{yi }is generated (block 820) for each of the sender's m ancestral lowerlevel PKGs. Each lowerlevel secret element, S_{yi}=S_{y(i−1)}+s_{y(i−1)}P_{yi }for 1≦i≦m, preferably is an element of the first cyclic group G_{1}. Although represented in a single block like the public elements P_{yi }and the secrets s_{yi}, generation of all the secret elements S_{yi }may take place over time, rather than all at once. For purposes of these iterative key generation processes, S_{0 }preferably is defined to be the identity element of G_{1}.
A lowerlevel key generation parameter Q_{yi }also is generated (block 824) for each of the sender's m ancestral lowerlevel PKGs. Each of the key generation parameters, Q_{yi}=s_{yi}P_{0 }for 1≦i≦m, preferably is an element of the first cyclic group G_{1}. Again, although represented in a single block, generation of all the key generation parameters Q_{yi }may take place over time, rather than all at once.
The functions of the next two blocks (blocks 824 and 826) are performed as part of the Extraction algorithm described above. A sender public element P_{y(m+1) }associated with the sender y is generated in block 824. The sender public element, P_{y(m+1)}=H_{1}(ID_{y1}, . . . , ID_{y(m+1)}), preferably is an element of the first cyclic group G_{1}. A sender secret element S_{y(m+1) }associated with the sender y is then generated in block 826. The sender secret element
also preferably is an element of the first cyclic group G_{1}.
For convenience, the first function H_{1 }optionally may be chosen to be an iterated function so that, for example, the public points P_{i }may be computed as H_{1}(P_{y(i−1)}, ID_{yi}) rather than H_{1 }(ID_{1}, . . . , ID_{yi}).
The last two blocks shown in
is satisfied.
The invention has been described in detail with particular reference to preferred embodiments thereof and illustrative examples, but it will be understood that variations and modifications can be effected within the spirit and scope of the invention.
Claims (41)
Priority Applications (3)
Application Number  Priority Date  Filing Date  Title 

US36629202 true  20020321  20020321  
US36619602 true  20020321  20020321  
US10384328 US7349538B2 (en)  20020321  20030307  Hierarchical identitybased encryption and signature schemes 
Applications Claiming Priority (11)
Application Number  Priority Date  Filing Date  Title 

US10384328 US7349538B2 (en)  20020321  20030307  Hierarchical identitybased encryption and signature schemes 
DE2003625575 DE60325575D1 (en)  20020321  20030318  Hierarchical verchlüsselung on identity and signaturebased schemes 
CN 03803910 CN1633774B (en)  20020321  20030318  Based on a hierarchical encryption and signature scheme 
JP2003579369A JP4405810B2 (en)  20020321  20030318  Encryption and signature scheme based on the identity of the Hierarchical 
PCT/US2003/008010 WO2003081780A3 (en)  20020321  20030318  Hierarchical identitybased encryption and signature schemes 
EP20080154836 EP2012459A1 (en)  20020321  20030318  Hierarchical identitybased encryption and signature schemes 
EP20030711597 EP1495573B1 (en)  20020321  20030318  Hierarchical identitybased encryption and signature schemes 
EP20100184410 EP2309671A3 (en)  20020321  20030318  Hierarchical identitybased encryption and signature schemes 
US11552076 US7337322B2 (en)  20020321  20061023  Hierarchical identitybased encryption and signature schemes 
US11780114 US7443980B2 (en)  20020321  20070719  Hierarchical identitybased encryption and signature schemes 
US11923148 US7590854B2 (en)  20020321  20071024  Hierarchical identitybased encryption and signature schemes 
Publications (2)
Publication Number  Publication Date 

US20030179885A1 true US20030179885A1 (en)  20030925 
US7349538B2 true US7349538B2 (en)  20080325 
Family
ID=28046523
Family Applications (4)
Application Number  Title  Priority Date  Filing Date 

US10384328 Active 20250208 US7349538B2 (en)  20020321  20030307  Hierarchical identitybased encryption and signature schemes 
US11552076 Active US7337322B2 (en)  20020321  20061023  Hierarchical identitybased encryption and signature schemes 
US11780114 Active US7443980B2 (en)  20020321  20070719  Hierarchical identitybased encryption and signature schemes 
US11923148 Active 20230603 US7590854B2 (en)  20020321  20071024  Hierarchical identitybased encryption and signature schemes 
Family Applications After (3)
Application Number  Title  Priority Date  Filing Date 

US11552076 Active US7337322B2 (en)  20020321  20061023  Hierarchical identitybased encryption and signature schemes 
US11780114 Active US7443980B2 (en)  20020321  20070719  Hierarchical identitybased encryption and signature schemes 
US11923148 Active 20230603 US7590854B2 (en)  20020321  20071024  Hierarchical identitybased encryption and signature schemes 
Country Status (6)
Country  Link 

US (4)  US7349538B2 (en) 
EP (3)  EP2012459A1 (en) 
JP (1)  JP4405810B2 (en) 
CN (1)  CN1633774B (en) 
DE (1)  DE60325575D1 (en) 
WO (1)  WO2003081780A3 (en) 
Cited By (9)
Publication number  Priority date  Publication date  Assignee  Title 

US20040123098A1 (en) *  20020705  20040624  Ligun Chen  Method and apparatus for use in relation to verifying an association between two parties 
US20050089173A1 (en) *  20020705  20050428  Harrison Keith A.  Trusted authority for identifierbased cryptography 
US20080052521A1 (en) *  20020321  20080228  Ntt Docomo Inc.  Hierarchical identitybased encryption and signature schemes 
US20080313465A1 (en) *  20020415  20081218  Ntt Docomo Inc.  Signature schemes using bilinear mappings 
US20090034740A1 (en) *  20020828  20090205  Gentry Craig B  Certificatebased encryption and public key infrastructure 
US20090089575A1 (en) *  20050623  20090402  Shoko Yonezawa  Service Providing System, Outsourcer Apparatus, Service Providing Method, and Program 
US20100020977A1 (en) *  20070213  20100128  Jun Furukawa  Key generation device, key derivation device, encryption device, decryption device, method and program 
US20100211782A1 (en) *  20090216  20100819  Microsoft Corporation  Trusted cloud computing and services framework 
US20100211781A1 (en) *  20090216  20100819  Microsoft Corporation  Trusted cloud computing and services framework 
Families Citing this family (51)
Publication number  Priority date  Publication date  Assignee  Title 

GB0215524D0 (en) *  20020705  20020814  Hewlett Packard Co  Method and apparatus for generating a cryptographic key 
US6886096B2 (en) *  20021114  20050426  Voltage Security, Inc.  Identitybased encryption system 
US7003117B2 (en) *  20030205  20060221  Voltage Security, Inc.  Identitybased encryption system for secure data distribution 
US8108678B1 (en) *  20030210  20120131  Voltage Security, Inc.  Identitybased signcryption system 
KR100507809B1 (en) *  20030319  20050817  학교법인 한국정보통신학원  Anonymous fingerprinting scheme based on the bilinear pairings diffiehellman problem 
GB2400699B (en) *  20030417  20060705  Hewlett Packard Development Co  Security data provision method and apparatus and data recovery method and system 
US7017181B2 (en) *  20030625  20060321  Voltage Security, Inc.  Identitybasedencryption messaging system with public parameter host servers 
US7580521B1 (en)  20030625  20090825  Voltage Security, Inc.  Identitybasedencryption system with hidden public key attributes 
US7103911B2 (en) *  20031017  20060905  Voltage Security, Inc.  Identitybasedencryption system with district policy information 
JP4741503B2 (en)  20031028  20110803  サーティコム コーポレーション  To verify possible to generate a public key and a device 
US20050135610A1 (en) *  20031101  20050623  Liqun Chen  Identifierbased signcryption 
GB2416282B (en)  20040715  20070516  Hewlett Packard Development Co  Identifierbased signcryption with two trusted authorities 
WO2006034428A3 (en) *  20040920  20070802  Pgp Corp  Apparatus and method for identitybased encryption within a conventional publickey infrastructure 
US20060078790A1 (en) *  20041005  20060413  Polyplus Battery Company  Solid electrolytes based on lithium hafnium phosphate for active metal anode protection 
WO2006082507A1 (en) *  20050204  20060810  Nokia Corporation  Apparatus, method and computer program product to reduce tcp flooding attacks while conserving wireless network bandwidth 
US20070050303A1 (en) *  20050824  20070301  Schroeder Dale W  Biometric identification device 
US7788484B2 (en) *  20051130  20100831  Microsoft Corporation  Using hierarchical identity based cryptography for authenticating outbound mail 
CN1859086B (en)  20051231  20100609  华为技术有限公司  Content grading access control system and method 
GB2434947B (en) *  20060202  20110126  Identum Ltd  Electronic data communication system 
US8670564B1 (en)  20060814  20140311  Key Holdings, LLC  Data encryption system and method 
US7900252B2 (en) *  20060828  20110301  Lenovo (Singapore) Pte. Ltd.  Method and apparatus for managing shared passwords on a multiuser computer 
US20080133905A1 (en) *  20061130  20080605  David Carroll Challener  Apparatus, system, and method for remotely accessing a shared password 
EP1986146A1 (en) *  20070427  20081029  Gemplus  Transaction method between two entities providing anonymity revocation for treebased schemes without trusted party 
US7890763B1 (en) *  20070914  20110215  The United States Of America As Represented By The Director, National Security Agency  Method of identifying invalid digital signatures involving batch verification 
JPWO2009110055A1 (en) *  20080303  20110714  株式会社Pfu  An image processing system, method and program 
CN101567784B (en) *  20080421  20160330  华为数字技术（成都）有限公司  A method for obtaining a key, the system and apparatus 
US8656177B2 (en) *  20080623  20140218  Voltage Security, Inc.  Identitybasedencryption system 
US9425960B2 (en) *  20081017  20160823  Sap Se  Searchable encryption for outsourcing data analytics 
US8315395B2 (en) *  20081210  20121120  Oracle America, Inc.  Nearlystateless key escrow service 
US8837718B2 (en) *  20090327  20140916  Microsoft Corporation  Userspecified sharing of data via policy and/or inference from a hierarchical cryptographic store 
EP2424155B1 (en) *  20090424  20140903  Nippon Telegraph And Telephone Corporation  Information generating device, information generating method, and information generating program and storage medium thereof 
DE102009027268B3 (en) *  20090629  20101202  Bundesdruckerei Gmbh  A method for generating an identifier 
CN102484586B (en) *  20090803  20141203  日本电信电话株式会社  Function cipher application system 
JP2011082662A (en) *  20091005  20110421  Mitsubishi Electric Corp  Communication device, and method and program for processing information 
CN101820626B (en)  20091019  20130410  兰州理工大学  Wireless MESH network ID based partially blind signature method without credible PKG (Private Key Generator) 
US8488783B2 (en) *  20100219  20130716  Nokia  Method and apparatus for applying recipient criteria in identitybased encryption 
US8744085B2 (en)  20100527  20140603  South China University Of Technology (Scut)  Hierarchical group key management approach based on linear geometry 
US20120069995A1 (en) *  20100922  20120322  Seagate Technology Llc  Controller chip with zeroizable root key 
JP5693206B2 (en) *  20101222  20150401  三菱電機株式会社  Cryptographic processing system, the key generation device, encryption device, a decryption device, an encryption processing method, and an encryption processing program 
CN102123138B (en) *  20110104  20141210  南京邮电大学  ONS (Object Naming Service)based secure encryption method in internet of things 
US9276746B2 (en) *  20110118  20160301  Mitsubishi Electric Corporation  Encryption system, encryption processing method of encryption system, encryption device, decryption device, setup device, key generation device, and key delegation device using a user identifier for a user who belongs to a kth hierarchy in an organization 
JP5606351B2 (en) *  20110209  20141015  三菱電機株式会社  Cryptographic processing system, the key generation device, encryption device, a decryption device, the key delegation device, the cryptographic processing method, and an encryption processing program 
WO2012141556A3 (en) *  20110415  20130314  Samsung Electronics Co., Ltd.  Machinetomachine node erase procedure 
KR101301609B1 (en) *  20120531  20130829  서울대학교산학협력단  Apparatus and method for generating secret key, and recording medium storing program for executing method of the same in computer 
JP5901803B2 (en) *  20130116  20160413  三菱電機株式会社  Information processing apparatus and information processing method, and program 
US9692759B1 (en)  20140414  20170627  Trend Micro Incorporated  Control of cloud application access for enterprise customers 
CN105024822A (en) *  20150713  20151104  西安理工大学  Identifybased encryption method from multilinear mapping 
CN105049211A (en) *  20150713  20151111  西安理工大学  Latticebased accumulatorbased revocable identitybased encryption method 
CN105024821A (en) *  20150713  20151104  西安理工大学  Identitybased encryption method allowing revocation at lattice 
CN105187202A (en) *  20150713  20151223  西安理工大学  Revocable attribute encryption method based on complete binary tree 
FR3043482A1 (en) *  20151106  20170512  Ingenico Group  Secure method of recording data, corresponding device and program 
Citations (23)
Publication number  Priority date  Publication date  Assignee  Title 

US4309569A (en)  19790905  19820105  The Board Of Trustees Of The Leland Stanford Junior University  Method of providing digital signatures 
US5432852A (en) *  19930929  19950711  Leighton; Frank T.  Large provably fast and secure digital signature schemes based on secure hash functions 
US5590197A (en)  19950404  19961231  VOne Corporation  Electronic payment system and method 
US5774552A (en)  19951213  19980630  Ncr Corporation  Method and apparatus for retrieving X.509 certificates from an X.500 directory 
US5867578A (en)  19950605  19990202  Certco Llc  Adaptive multistep digital signature system and method of operation thereof 
US6141420A (en) *  19940729  20001031  Certicom Corp.  Elliptic curve encryption systems 
EP1051036A2 (en)  19990507  20001108  Lucent Technologies Inc.  Cryptographic method and apparatus for restricting access to transmitted programming content using hash functions and program identifiers 
US6212637B1 (en)  19970704  20010403  Nippon Telegraph And Telephone Corporation  Method and apparatus for enbloc verification of plural digital signatures and recording medium with the method recorded thereon 
US20020025034A1 (en) *  20000818  20020228  Solinas Jerome Anthony  Cryptographic encryption method using efficient elliptic curve 
US20020154782A1 (en)  20010323  20021024  Chow Richard T.  System and method for key distribution to maintain secure communication 
US20030081785A1 (en)  20010813  20030501  Dan Boneh  Systems and methods for identitybased encryption and related cryptographic techniques 
US20030097562A1 (en)  20000804  20030522  First Data Corporation  Managing Database for Reliably Identifying Information of Device Generating Digital Signatures 
US20030179885A1 (en)  20020321  20030925  Docomo Communications Laboratories Usa, Inc.  Hierarchical identitybased encryption and signature schemes 
US6760441B1 (en)  20000331  20040706  Intel Corporation  Generating a key hieararchy for use in an isolated execution environment 
US20040215661A1 (en) *  20030422  20041028  International Business Machines Corporation  Method and apparatus for generating hierarchical keys of digital assets 
US6826687B1 (en) *  19990507  20041130  International Business Machines Corporation  Commitments in signatures 
US20050022102A1 (en)  20020415  20050127  Gentry Craig B  Signature schemes using bilinear mappings 
US6886296B1 (en) *  20000814  20050503  Michael John  Wooden post protective sleeve 
US20050246533A1 (en)  20020828  20051103  Docomo Communications Laboratories Usa, Inc.  Certificatebased encryption and public key infrastructure 
US7088822B2 (en)  20010213  20060808  Sony Corporation  Information playback device, information recording device, information playback method, information recording method, and information recording medium and program storage medium used therewith 
US7178025B2 (en)  19980213  20070213  Tec Sec, Inc.  Access system utilizing multiple factor identification and authentication 
US7224804B2 (en)  20001109  20070529  Sony Corporation  Information processing device, information processing method, and program storage medium 
US7225339B2 (en)  20000406  20070529  Sony Corporation  Information recording/playback apparatus and method 
Family Cites Families (14)
Publication number  Priority date  Publication date  Assignee  Title 

DE69534192D1 (en) *  19940729  20050616  Canon Kk  Method for sharing a secret information, to generate a digital signature and for performing authentication in a communication system having a plurality of information processing devices and communication system for use of this method 
US5638447A (en) *  19960515  19970610  Micali; Silvio  Compact digital signatures 
US6298153B1 (en) *  19980116  20011002  Canon Kabushiki Kaisha  Digital signature method and information communication system and apparatus using such method 
JP4660899B2 (en)  20000724  20110330  ソニー株式会社  Data processing apparatus and data processing method, and program providing medium 
US7093133B2 (en) *  20011220  20060815  HewlettPackard Development Company, L.P.  Group signature generation system using multiple primes 
FR2855343B1 (en) *  20030520  20051007  France Telecom  Method for electronic signature group with revocable anonymity, equipment and programs for the implementation of the Method 
KR100537514B1 (en) *  20031101  20051219  삼성전자주식회사  Electronic signature method based on identity information of group members and method for acquiring identity information of signedgroup member and electronic signature system for performing electronic signature based on identity information of group members 
EP1548976B1 (en) *  20031224  20070822  STMicroelectronics S.r.l.  A message deciphering method 
WO2005071880A1 (en) *  20040123  20050804  Nec Corporation  Group signature system, method, device, and program 
JP4546231B2 (en) *  20041209  20100915  株式会社日立製作所  Id based signature and encryption systems and methods 
KR100909503B1 (en) *  20050121  20090727  닛본 덴끼 가부시끼가이샤  Group signature schemes 
KR100737876B1 (en) *  20050225  20070712  삼성전자주식회사  The hierarchial threshold treebased broadcast encryption method 
JP5029358B2 (en) *  20050719  20120919  日本電気株式会社  The key issuing method, the group signature system 
US8060741B2 (en) *  20061229  20111115  Industrial Technology Research Institute  System and method for wireless mobile network authentication 
Patent Citations (28)
Publication number  Priority date  Publication date  Assignee  Title 

US4309569A (en)  19790905  19820105  The Board Of Trustees Of The Leland Stanford Junior University  Method of providing digital signatures 
US5432852A (en) *  19930929  19950711  Leighton; Frank T.  Large provably fast and secure digital signature schemes based on secure hash functions 
US6141420A (en) *  19940729  20001031  Certicom Corp.  Elliptic curve encryption systems 
US6618483B1 (en) *  19940729  20030909  Certicom Corporation  Elliptic curve encryption systems 
US5590197A (en)  19950404  19961231  VOne Corporation  Electronic payment system and method 
US5867578A (en)  19950605  19990202  Certco Llc  Adaptive multistep digital signature system and method of operation thereof 
US5774552A (en)  19951213  19980630  Ncr Corporation  Method and apparatus for retrieving X.509 certificates from an X.500 directory 
US6212637B1 (en)  19970704  20010403  Nippon Telegraph And Telephone Corporation  Method and apparatus for enbloc verification of plural digital signatures and recording medium with the method recorded thereon 
US7178025B2 (en)  19980213  20070213  Tec Sec, Inc.  Access system utilizing multiple factor identification and authentication 
EP1051036A2 (en)  19990507  20001108  Lucent Technologies Inc.  Cryptographic method and apparatus for restricting access to transmitted programming content using hash functions and program identifiers 
US6826687B1 (en) *  19990507  20041130  International Business Machines Corporation  Commitments in signatures 
US6760441B1 (en)  20000331  20040706  Intel Corporation  Generating a key hieararchy for use in an isolated execution environment 
US7225339B2 (en)  20000406  20070529  Sony Corporation  Information recording/playback apparatus and method 
US20030095665A1 (en)  20000804  20030522  First Data Corporation  Incorporating Security Certificate During Manufacture of Device Generating Digital Signatures 
US20030097562A1 (en)  20000804  20030522  First Data Corporation  Managing Database for Reliably Identifying Information of Device Generating Digital Signatures 
US20030097569A1 (en)  20000804  20030522  First Data Corporation  Reliably Identifying Information of Device Generating Digital Signatures 
US6886296B1 (en) *  20000814  20050503  Michael John  Wooden post protective sleeve 
US20020025034A1 (en) *  20000818  20020228  Solinas Jerome Anthony  Cryptographic encryption method using efficient elliptic curve 
US7224804B2 (en)  20001109  20070529  Sony Corporation  Information processing device, information processing method, and program storage medium 
US7088822B2 (en)  20010213  20060808  Sony Corporation  Information playback device, information recording device, information playback method, information recording method, and information recording medium and program storage medium used therewith 
US20020154782A1 (en)  20010323  20021024  Chow Richard T.  System and method for key distribution to maintain secure communication 
US7113594B2 (en) *  20010813  20060926  The Board Of Trustees Of The Leland Stanford University  Systems and methods for identitybased encryption and related cryptographic techniques 
US20030081785A1 (en)  20010813  20030501  Dan Boneh  Systems and methods for identitybased encryption and related cryptographic techniques 
US20070050629A1 (en) *  20020321  20070301  Gentry Craig B  Hierarchical identitybased encryption and signature schemes 
US20030179885A1 (en)  20020321  20030925  Docomo Communications Laboratories Usa, Inc.  Hierarchical identitybased encryption and signature schemes 
US20050022102A1 (en)  20020415  20050127  Gentry Craig B  Signature schemes using bilinear mappings 
US20050246533A1 (en)  20020828  20051103  Docomo Communications Laboratories Usa, Inc.  Certificatebased encryption and public key infrastructure 
US20040215661A1 (en) *  20030422  20041028  International Business Machines Corporation  Method and apparatus for generating hierarchical keys of digital assets 
NonPatent Citations (34)
Title 

A. Fiat, A. Shamir, How to Prove Yourself: Practical Solutions to Identification and Signature Problems, 1998, pp. 186194. 
A. Joux, A One Round Protocol for Tripartite DiffieHellman, W. Bosma (Ed.), ANTSIV, LNCS 1838, pp. 385393, 2000. 
A. Menezes, P. van Oorschot, S. Vanstone, Chapter 12 Key Establishment Protocols, Handbook of Applied Cryptography, 1997, pp. 489541. 
A. Shamir, IdentityBased Cryptosystems and Signature Schemes, 1998, SpringerVerlag, pp. 4653. 
Boyd, "Multisignatures Based on Zero Knowledge Schemes", Electronic Letters, Fol. 27, No. 22, pp. 13. 
C. Blundo, A De Santis, A. Herzberg, S. Kutten, U. Vaccaro, M. Yung, PerfectlySecure Key Distribution for Dynamic Conferences, 1998, SpringerVerlag, pp. 471486. 
C. Cocks, An Identity Based Encryption Scheme Based On Quadratic Equations,. 
C.G. Günther, A.B. Boveri, An IdentityBased KeyExchange Protocol, pp. 2937. 
D. Boneh, B. Lynn, H. Shacham, Short Signatures from the Weil Pairing, Advances in Cryptology: Asiacrypt 2001 (LNCS 2248), pp. 514532, 2001. 
D. Boneh, M. Franklin, IdentityBased Encryption from the Weil Pairing, Advances in CryptologyCrypto2001, Springer LNCS 2139. 
Dutta, Ratna et al. PairingBased Cryptographic Protocols: A Survey. Cryptographic Research Group. 2004. * 
E. Fujisaki, T.,Okamoto, Secure Integration of Asymmetric and Symmetric Encryption Schemes, Michael Wiener (Ed.): Crytpto'99, LNCS 1666, pp. 537554, 1999. 
F. Hess, Exponent Group Signature Schemes and Efficient Identity Based Signature Schemes based on Pairings, Cryptology EPrint Archive, Report 2002/012, 2002. http://eprint.iacr.org/. 
G. Hanaoka, T. Nishioka, Y. Zheng, H. Imai, A Hierarchical NonInteractive KeySharing Scheme with Low Memory Size and High Resistance Against Collusion Attacks, The Computer Journal, vol. 45, No. 3, 2002. 
G. Hanaoka, T. Nishioka, Y. Zheng, H. Imai, An Efficient Hierarchical IdentityBased KeySharing Method Resistant Against CollusionAttacks, JSPSREFT 96P00604, pp. 348362. 
Gentry, Craig and Silverberg, Alice: "Hierarchical IDBased Cryptography," May 24, 2002, pp. 121, XP002396667. 
J. Horwitz, B. Lynn, Toward Hierarchical IdentityBased Encryption. 
J.C. Cha and J.H. Cheon, An IdentityBased Signature from Gap DiffieHellman Groups, Cryptology ePrint archive, Report 2002/018, 2002. http://eprint.iacr.org/ . 
K. Rubin, A. Silverberg, Supersingular Abelian Varieties in Cryptolog, y. 
L.C. Guillou, J. Quisquater, A Practical ZeroKnowledge Protocol Fitted to Security Microprocessor Minimizing Both Transmission and Memory, Advances in CryptologyEuroCrypt'88, Lect. Notes in Computer Science, vol. 330, pp. 123128, SpringerVerlag (1988). 
M. Girault, SelfCertified Public Keys, 1998, pp. 490497. 
N. Koblitz, Elliptic Curve Cryptosystems, Mathematics of Computation, vol. 48, No. 177, Jan. 1987, pp. 203209. 
N.P. Smart, An IdentityBased Authenticated Key Agreement Protocol Based on the Weil Pairing, Cryptology EPrint Archive, Report 2001/111, 2001. http://eprint.iacr.org/ . 
Okamato, "A Digital Multisignature Scheme Using Bijective Public Key Cryptosystems," ACM Transactions on Computer Systems, Vo. 6, No. 8, Nov. 1992, pp. 432441. 
R. Blom, An Optimal Class of Symmetric Key Generation Systems, 1998, pp. 336338. 
S.S. AlRiyami, K.G. Paterson, Authenticated Three Party Key Agreement Protocols From Pairings, 2002. 
Sakai, Ryuichi et al., "Crypt shemes based on Weil Pairing," pp. 112. 
Sakai, Ryuichi et al., "Cryptosystems Based on Pairing over Elliptic Curve", The 2001 Symposium on Cryptography and Information Security, Oiso, Japan, Jan. 2326, 2001. The Institute of Electronics, Information and Communication Engineers. 
Sakai, Ryuichi et al., "Cryptosystems Based on Pairing", The 2000 Symposium on Cryptography and Information Security, Okinawa, Japan, Jan. 2628, 2000, SCIS2000C20, The. 
U. Feige, A. Fiat, A. Shamir, Zero Knowledge Proofs of Identity, 1987 ACM O89791227/87/00060210, pp. 210217. 
U. Maurer, Y. Yacobi, A Remark on a NonInteractive PublicKey Distribution System, 1998. 
V.S. Miller, Use of Elliptic Curves in Cryptography, 1998, pp. 417426. 
W. Diffie, M.E. Hellman, New Directions in Cryptography, pp. 2940. 
Y. Dodis, M. Yung, ExposureResilience for Free: The Hierarchical IDBased Encryption Case. 
Cited By (17)
Publication number  Priority date  Publication date  Assignee  Title 

US7590854B2 (en) *  20020321  20090915  Ntt Docomo, Inc.  Hierarchical identitybased encryption and signature schemes 
US20080052521A1 (en) *  20020321  20080228  Ntt Docomo Inc.  Hierarchical identitybased encryption and signature schemes 
US20080313465A1 (en) *  20020415  20081218  Ntt Docomo Inc.  Signature schemes using bilinear mappings 
US7853016B2 (en)  20020415  20101214  Ntt Docomo, Inc.  Signature schemes using bilinear mappings 
US20050089173A1 (en) *  20020705  20050428  Harrison Keith A.  Trusted authority for identifierbased cryptography 
US7650494B2 (en)  20020705  20100119  HewlettPackard Development Company, L.P.  Method and apparatus for use in relation to verifying an association between two parties 
US20040123098A1 (en) *  20020705  20040624  Ligun Chen  Method and apparatus for use in relation to verifying an association between two parties 
US20090034740A1 (en) *  20020828  20090205  Gentry Craig B  Certificatebased encryption and public key infrastructure 
US7751558B2 (en)  20020828  20100706  Ntt Docomo, Inc.  Certificatebased encryption and public key infrastructure 
US7796751B2 (en)  20020828  20100914  Ntt Docomo, Inc.  Certificatebased encryption and public key infrastructure 
US20090089575A1 (en) *  20050623  20090402  Shoko Yonezawa  Service Providing System, Outsourcer Apparatus, Service Providing Method, and Program 
US20100020977A1 (en) *  20070213  20100128  Jun Furukawa  Key generation device, key derivation device, encryption device, decryption device, method and program 
US8340284B2 (en) *  20070213  20121225  Nec Corporation  Key generation device, key derivation device, encryption device, decryption device, method and program 
US20100211781A1 (en) *  20090216  20100819  Microsoft Corporation  Trusted cloud computing and services framework 
US8341427B2 (en)  20090216  20121225  Microsoft Corporation  Trusted cloud computing and services framework 
US20100211782A1 (en) *  20090216  20100819  Microsoft Corporation  Trusted cloud computing and services framework 
US9165154B2 (en)  20090216  20151020  Microsoft Technology Licensing, Llc  Trusted cloud computing and services framework 
Also Published As
Publication number  Publication date  Type 

EP2309671A3 (en)  20130828  application 
EP1495573A2 (en)  20050112  application 
WO2003081780A3 (en)  20040219  application 
US20080013722A1 (en)  20080117  application 
US7590854B2 (en)  20090915  grant 
US7443980B2 (en)  20081028  grant 
EP1495573B1 (en)  20081231  grant 
US20070050629A1 (en)  20070301  application 
JP4405810B2 (en)  20100127  grant 
WO2003081780A2 (en)  20031002  application 
US20030179885A1 (en)  20030925  application 
EP2309671A2 (en)  20110413  application 
EP1495573A4 (en)  20061011  application 
CN1633774B (en)  20111207  grant 
DE60325575D1 (en)  20090212  grant 
CN1633774A (en)  20050629  application 
JP2005521323A (en)  20050714  application 
US7337322B2 (en)  20080226  grant 
US20080052521A1 (en)  20080228  application 
EP2012459A1 (en)  20090107  application 
Similar Documents
Publication  Publication Date  Title 

Boldyreva et al.  Identitybased encryption with efficient revocation  
Boneh et al.  Chosenciphertext security from identitybased encryption  
Choon et al.  An identitybased signature from gap DiffieHellman groups  
Li et al.  Certificateless signature and proxy signature schemes from bilinear pairings  
Boneh et al.  Efficient selectiveID secure identitybased encryption without random oracles  
Boyen et al.  Compact group signatures without random oracles  
Gentry et al.  Identitybased aggregate signatures  
Green et al.  Identitybased proxy reencryption  
Steinfeld et al.  Universal designatedverifier signatures  
Chen et al.  A New IDbased Group Signature Scheme from Bilinear Pairings.  
Baek et al.  Certificateless public key encryption without pairing  
Gentry  Practical identitybased encryption without random oracles  
Cocks  An identity based encryption scheme based on quadratic residues  
Lee et al.  Secure key issuing in IDbased cryptography  
Chen et al.  Improved identitybased signcryption  
Gentry  Certificatebased encryption and the certificate revocation problem  
Li et al.  Certificatebased signature: security model and efficient construction  
Yi  An identitybased signature scheme from the Weil pairing  
Boneh et al.  Chosen ciphertext secure public key threshold encryption without random oracles  
US6282295B1 (en)  Autorecoverable and autocertifiable cryptostem using zeroknowledge proofs for key escrow in general exponential ciphers  
Awasthi et al.  IDbased ring signature and proxy ring signature schemes from bilinear pairings  
Boneh et al.  Generalized identity based and broadcast encryption schemes  
Liu et al.  Selfgeneratedcertificate public key cryptography and certificateless signature/encryption scheme in the standard model  
Chu et al.  Identitybased proxy reencryption without random oracles  
Waters  Efficient identitybased encryption without random oracles 
Legal Events
Date  Code  Title  Description 

AS  Assignment 
Owner name: DOCOMO COMMUNICATIONS LABORATORIES USA, INC., CALI Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:GENTRY, CRAIG B.;SILVERBERG, ALICE;REEL/FRAME:013867/0178;SIGNING DATES FROM 20030219 TO 20030303 

AS  Assignment 
Owner name: NTT DOCOMO INC., JAPAN Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:DOCOMO COMMUNICATIONS LABORATORIES USA, INC.;REEL/FRAME:017213/0760 Effective date: 20051107 Owner name: NTT DOCOMO INC.,JAPAN Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:DOCOMO COMMUNICATIONS LABORATORIES USA, INC.;REEL/FRAME:017213/0760 Effective date: 20051107 

FPAY  Fee payment 
Year of fee payment: 4 

FPAY  Fee payment 
Year of fee payment: 8 